TI-2021-17958 Aliases CVE-2021-41119

DoS vulnerabiliity in wire-server json parser

HIGH 72CWE-400Published 2022-04-13 · Updated 2025-04-22

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-400.

Summary

Wire-server is the system server for the wire back-end services. Releases prior to v2022-03-01 are subject to a denial of service attack via a crafted object causing a hash collision. This collision causes the server to spend at least quadratic time parsing it which can lead to a denial of service for a heavily used server. The issue has been fixed in wire-server 2022-03-01 and is already deployed on all Wire managed services. On premise instances of wire-server need to be updated to 2022-03-01, so that their backends are no longer affected. There are no known workarounds for this issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.01361 71st percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed wire-server (wireapp): v2022-03-01

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
wireapp	wire-server	before v2022-03-01	v2022-03-01	Patch available	CNA

wire-server Vendorwireapp Affected before v2022-03-01 Fixed in v2022-03-01 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:wire:wire-server::::::::	before 2022-03-01	Vulnerable	wireapp

cpe:2.3:a:wire:wire-server:*:*:*:*:*:*:*:* Versions before 2022-03-01 Vulnerable ·wireapp

Remediation

Fix · CNA wire-server (wireapp) Fixed in v2022-03-01

Timeline

2026-10-02 Threatist record created from CVE-2021-41119

References

Exploit 1

https://cs-syd.eu/posts/2021-09-11-json-vulnerability

Advisory 1

https://github.com/wireapp/wire-server/security/advisories/GHSA-phxv-pffh-fq2r

TI-2022-07663 Improper Verification of Cryptographic Signature in wire-server CVSS 3.1CRITICAL 9.1
TI-2021-17942 Account takeover when having only access to a user's short lived token in wire-server CVSS 3.1CRITICAL 9.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences